Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I don’t mean “flag file configured properly” - instead I am getting an error: 

```[eventfactory.cpp:156] event publisher not enabled: BPFEventPublisher: failed to create the function tracer: Module verification failed: Stored value type does not match pointer operand type!

Store i32 %29, i64* %30, align 4
i64```

Could you provide more information about the error? There should be some more text above it if I'm not mistaken. Could you also share which distribution and kernel version this is?

Will do, its at work, need to do it tomorrow. Thanks for follow up!

Actually, thats the entire line in osqueryd.INFO.*

its `RHEL 9.7 kernel 5.14.0-687.12.1.e19_8.x86_64`

Works in Ubuntu `24.04 6.17.0-29-generic` same flags file

the ubuntu client is on osquery 5.20, the rhel one 5.23

5.23 on Ubuntu still works. Problem is rhel side